False positive with Bart PE and PrevX?

[pc-support]

27/10/2006 11:35:38 AMON file C:\pebuilder3110a\BartPE\I386\SYSTEM32\CMDOW.EXE Win32/CMDOW.142 application error while cleaning - operation unavailable for this type of object PCSUPPORT\Administrator Event occurred at an attempt to access the file by the application: C:\Program Files\Prevx1\PXConsole.exe.


Thoughts please!

[NOD32 user]

{QUOTE-> 27/10/2006 11:35:38 AMON file C:\pebuilder3110a\BartPE\I386\SYSTEM32\CMDOW.EXE Win32/CMDOW.142 application error while cleaning - operation unavailable for this type of object PCSUPPORT\Administrator Event occurred at an attempt to access the file by the application: C:\Program Files\Prevx1\PXConsole.exe.


Thoughts please! <-QUOTE}Not a false positive, you have enabled detection of potentially dangerous applications - 'Win32/CMDOW.142 application' and was triggered when PrevX tried to access CMDOW.EXE

If it got on your system other than by your own deliberate actions you would definitely want it detected.

Cheers :)

[pc-support]

But as part of the Bart PE installation files??

It's a ligitimate file...

Maybe ESET could/should recatogrise it.

http://www.commandline.co.uk/cmdow/

[NOD32 user]

{QUOTE-> But as part of the Bart PE installation files??

It's a ligitimate file...

Maybe ESET could/should recatogrise it.

http://www.commandline.co.uk/cmdow/ <-QUOTE}Mostly potentially dangerous applications are legitimate files - otherwise they would be called malware or something instead.

Cheers :)

[kjempen]

"Some anti-virus software vendors now classify cmdow.exe as a hacking tool because it can hide windows."

I've seen this used in a malicious way. It was used in combination with trojans (mIRC-backdoor servers) and "worms". The user doesn't really notice it running in the background, because this application hides it.